14 lines
671 B
TypeScript
14 lines
671 B
TypeScript
import { timingSafeEqual } from "node:crypto";
|
|
import { deriveCsrfToken as deriveStoredCsrfToken } from "./session-store.js";
|
|
|
|
export { deriveStoredCsrfToken as deriveCsrfToken };
|
|
|
|
/** Compare a client-supplied CSRF value without exposing a useful length timing oracle. */
|
|
export function csrfTokensEqual(expectedToken: string, suppliedToken: string | undefined): boolean {
|
|
const expected = Buffer.from(expectedToken, "utf8");
|
|
const supplied = Buffer.from(suppliedToken ?? "", "utf8");
|
|
const padded = Buffer.alloc(expected.length);
|
|
supplied.copy(padded, 0, 0, expected.length);
|
|
return timingSafeEqual(expected, padded) && supplied.length === expected.length;
|
|
}
|